feat(uploads): add Uploader subsystem (file discovery + readiness) [M2]

[ben-miru]

Summary

M2 of the data-upload feature: an Uploader subsystem that discovers which on-device files are ready to upload. It is structured exactly like the existing Syncer/poller split — a stateful Uploader object that owns the rules and logic, plus a thin timing-only worker that drives it — with the Syncer pushing the active rule set to the uploader. It does not upload anything yet: ready files are logged as a placeholder sink that M3 will replace with the mint → PUT → confirm pipeline.

This branch was rebased onto main after the upload-rule data model (#101) and the poll_interval_secs contract removal (#100) landed. The now-redundant data-model / get-release / deployment-linkage changes were dropped in favor of main's canonical versions; the branch retains only its unique uploader work and consumes Release.upload_rule_ids (added by #101) as an input.

Architecture

Three pieces, mirroring how the Syncer is split from the poller:

• Uploader actor (agent/src/upload/) — a stateful mpsc Command actor (UpdateRules / Scan / Shutdown) wrapped by a cloneable Uploader handle and an UploaderExt trait, mirroring SingleThreadSyncer / Syncer / SyncerExt. It owns, in memory: the active upload rule set, per-file readiness/observation state, a single global poll cadence, glob matching, the decide_ready stability logic, and the placeholder ready-file log sink. It has no storage dependency.
• Thin uploads worker (agent/src/workers/uploads.rs) — timing only, mirroring poller: it ticks on a base interval and calls uploader.scan(). No rules, no logic.
• Syncer push — the Syncer pushes the active rule set to the uploader via uploader.update_rules(...) after applying deployments each sync. The deployment → release → rules traversal lives in agent/src/sync/upload_rules.rs.

Why: clean separation of concerns — the worker handles timing, the uploader handles rules + readiness logic, and the syncer decides which rules are active. The Uploader is spawned in AppState::init before the Syncer; its handle is injected into SyncerArgs and into the worker.

What it discovers

• Glob match per rule — each active UploadRule is matched against its absolute source.glob (via the glob crate; enumeration runs under spawn_blocking).
• Global cadence — poll_interval_secs was removed from the upload-rule contract (chore(api): sync vendored backend openapi spec and regen models #100), so every rule's next scan is now scheduled off a single global min_poll_interval_secs, owned by the uploader, rather than a per-rule interval.
• Readiness / quiescence — a matched file is "ready" once its size and mtime have been unchanged for >= stability_window_secs (per-file observation state, reset on any change). The pure decide_ready seam makes readiness + dedupe deterministic to test.
• Finalization-marker hook — MCAP/parquet finalization detection is left as a documented hook at the readiness-decision point.
• Placeholder sink — newly-ready files are emitted via info! ({file_path, file_modified_at}) and deduped in-memory so each ready file is reported once. M3 replaces this sink with mint → PUT → confirm.

Rule sourcing

The active rule set is computed by traversal and pushed by the syncer on each sync: the currently-Deployed deployment(s) → their release → the release's upload_rule_ids → rule bodies. The result is unioned across Deployed deployments (normally a singleton; the union avoids dropping an outgoing release's files mid-redeploy) and deduped by id. No deployed deployment ⇒ empty set ⇒ the uploader idles.

• Release.upload_rule_ids — the domain Release carries upload_rule_ids (added on main by feat(release): carry upload-rule ids on domain Release #101, mirroring Deployment.config_instance_ids); this PR consumes it as the traversal input rather than adding it.
• In-memory in the uploader — rules are held in memory and replaced on each update_rules push (first-sync seeding). Rules from a since-replaced release are simply ignored.
• Append-only store, no pruning — the UploadRules store stays the append-only by-id body cache; it remains the syncer's body source keyed off upload_rule_ids, and is never pruned.

Dependency

Adds glob (workspace dep, locked 0.3.3) — a single absolute pattern per rule that both walks the filesystem and matches in one call. cargo machete sees it used; audit clean.

Scope

Discovery + readiness only, with a placeholder log sink. Out of scope (M3–M5): sha256/digest, POST /uploads, presigned PUT, POST confirm, the upload ledger, and delete_policy enforcement. M3 (mint + PUT + confirm) replaces the log sink next.

Testing

scripts/preflight.sh → Preflight clean (import-linter, fmt, clippy -D warnings, cargo-diet, machete, audit, full suite — 1379 main + tools tests pass, all coverage thresholds met). The separate lint gate is also clean.

• Uploader unit tests — update_rules replaces the set; the global cadence via injected clock (scan_uses_global_cadence, plus scan_skips_rule_until_cadence_elapses covering the not-yet-due skip branch — replacing the old per-rule scan_honors_per_rule_cadence); the readiness/stability window; dedupe-once across scans; empty-set idle no-op (a #[cfg(feature="test")] GetReportedCount inspector makes readiness/cadence/dedupe observable through the public handle). Fixtures dropped the now-removed poll_interval_secs arg from rule_with.
• Thin-worker timing test — a counting UploaderExt mock asserts one scan() per tick plus shutdown.
• Relocated traversal tests — the active_upload_rules traversal cases (resolved, stale-skip, no-deployed-idle, missing-id, missing-release, union/dedupe, cache-error arms) moved with the code into sync/upload_rules.
• Syncer-push test — sync_impl computes deployed → release → rules and pushes the active set to the uploader.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}